From 06db3934881bc55851e1ff171fca89abc7deebe5 Mon Sep 17 00:00:00 2001
From: Fringg <egor.andrianovv@gmail.com>
Date: Wed, 29 Apr 2026 11:14:24 +0300
Subject: [PATCH] feat: add bulk_actions, info_pages, news to
 PERMISSION_REGISTRY

- bulk_actions: read, execute (was using users:edit)
- info_pages: read, create, edit, delete (was using settings:read/edit)
- news: read, create, edit, delete (was missing from registry entirely)

Backend endpoints updated to use dedicated permissions instead of
piggybacking on users:edit / settings:read.
---
 app/cabinet/routes/admin_bulk_actions.py |  2 +-
 app/cabinet/routes/admin_info_pages.py   | 14 +++++++-------
 app/services/permission_service.py       |  3 +++
 3 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/app/cabinet/routes/admin_bulk_actions.py b/app/cabinet/routes/admin_bulk_actions.py
index d102a46d..a0b1e5c6 100644
--- a/app/cabinet/routes/admin_bulk_actions.py
+++ b/app/cabinet/routes/admin_bulk_actions.py
@@ -890,7 +890,7 @@ async def _execute_for_subscription(
 async def bulk_execute(
     request: BulkExecuteRequest,
     stream: bool = Query(default=False, description='Stream progress via SSE'),
-    admin: User = Depends(require_permission('users:edit')),
+    admin: User = Depends(require_permission('bulk_actions:execute')),
     db: AsyncSession = Depends(get_cabinet_db),
 ):
     """Execute a bulk action on multiple users or subscriptions.
diff --git a/app/cabinet/routes/admin_info_pages.py b/app/cabinet/routes/admin_info_pages.py
index 3749e186..fe672ac6 100644
--- a/app/cabinet/routes/admin_info_pages.py
+++ b/app/cabinet/routes/admin_info_pages.py
@@ -34,7 +34,7 @@ router = APIRouter(prefix='/admin/info-pages', tags=['Cabinet Admin Info Pages']
 @router.get('', response_model=list[InfoPageListItem])
 async def list_all_info_pages(
     page_type: str | None = Query(None, pattern=r'^(page|faq)$'),
-    admin: User = Depends(require_permission('settings:read')),
+    admin: User = Depends(require_permission('info_pages:read')),
     db: AsyncSession = Depends(get_cabinet_db),
 ) -> list[InfoPageListItem]:
     """Get all info pages (admin view, includes inactive)."""
@@ -54,7 +54,7 @@ async def list_all_info_pages(
 @router.get('/{page_id}', response_model=InfoPageResponse)
 async def get_info_page_detail(
     page_id: int,
-    admin: User = Depends(require_permission('settings:read')),
+    admin: User = Depends(require_permission('info_pages:read')),
     db: AsyncSession = Depends(get_cabinet_db),
 ) -> InfoPageResponse:
     """Get a single info page by ID (admin view)."""
@@ -70,7 +70,7 @@ async def get_info_page_detail(
 @router.post('', response_model=InfoPageResponse, status_code=status.HTTP_201_CREATED)
 async def create_page(
     request: InfoPageCreateRequest,
-    admin: User = Depends(require_permission('settings:edit')),
+    admin: User = Depends(require_permission('info_pages:edit')),
     db: AsyncSession = Depends(get_cabinet_db),
 ) -> InfoPageResponse:
     """Create a new info page."""
@@ -108,7 +108,7 @@ async def create_page(
 async def update_page(
     page_id: int,
     request: InfoPageUpdateRequest,
-    admin: User = Depends(require_permission('settings:edit')),
+    admin: User = Depends(require_permission('info_pages:edit')),
     db: AsyncSession = Depends(get_cabinet_db),
 ) -> InfoPageResponse:
     """Update an existing info page."""
@@ -150,7 +150,7 @@ async def update_page(
 @router.delete('/{page_id}', status_code=status.HTTP_204_NO_CONTENT)
 async def remove_page(
     page_id: int,
-    admin: User = Depends(require_permission('settings:edit')),
+    admin: User = Depends(require_permission('info_pages:edit')),
     db: AsyncSession = Depends(get_cabinet_db),
 ) -> None:
     """Delete an info page."""
@@ -174,7 +174,7 @@ async def remove_page(
 @router.post('/reorder', status_code=status.HTTP_204_NO_CONTENT)
 async def reorder_pages(
     request: ReorderRequest,
-    admin: User = Depends(require_permission('settings:edit')),
+    admin: User = Depends(require_permission('info_pages:edit')),
     db: AsyncSession = Depends(get_cabinet_db),
 ) -> None:
     """Bulk update sort_order for info pages."""
@@ -191,7 +191,7 @@ async def reorder_pages(
 @router.post('/{page_id}/toggle-active', response_model=InfoPageResponse)
 async def toggle_active(
     page_id: int,
-    admin: User = Depends(require_permission('settings:edit')),
+    admin: User = Depends(require_permission('info_pages:edit')),
     db: AsyncSession = Depends(get_cabinet_db),
 ) -> InfoPageResponse:
     """Toggle the active status of an info page."""
diff --git a/app/services/permission_service.py b/app/services/permission_service.py
index fbcebd66..0acb4037 100644
--- a/app/services/permission_service.py
+++ b/app/services/permission_service.py
@@ -77,6 +77,9 @@ PERMISSION_REGISTRY: dict[str, list[str]] = {
     'pinned_messages': ['read', 'create', 'edit', 'delete'],
     'landings': ['read', 'create', 'edit', 'delete'],
     'updates': ['read', 'manage'],
+    'bulk_actions': ['read', 'execute'],
+    'info_pages': ['read', 'create', 'edit', 'delete'],
+    'news': ['read', 'create', 'edit', 'delete'],
 }